Supported Hardware

See these supported hardware for supported processors.

Intel® TCC Tools currently supports the following processors:

• Intel® Xeon® W-11000E Series Processors (code name: Tiger Lake H Processors)

• 12th Generation Intel® Core™ Processors (code name: Alder Lake -S Processors)

• 11th Generation Intel® Core™ Processors (code name: Tiger Lake UP3 Processors)

• Intel Atom® x6000E Series Processors (code name: Elkhart Lake Processors)

SBL Prerequisites

You will need the DediProg* device, DediProg software (engineering version), and a Windows* Host.

Download the SBL Source Code

1. Download the SBL source code by referring to the SBL Firmware Release Notes for your platform:

   SBL Firmware Release Notes

   Supported Hardware	SBL Firmware Release Notes Document Number
   Intel® Xeon® W-11000E Series Processors (Code Name: Tiger Lake H Processors)	634385
   12th Generation Intel® Core™ Processors (Code Name: Alder Lake Processors)	751890
   11th Generation Intel® Core™ Processors (Code Name: Tiger Lake UP3 Processors)	614394
   Intel Atom® x6000E Series Processors (Code Name: Elkhart Lake Processors)	616714

2. Extract the compressed file. You will see three files: Readme_Extract.txt, ReleaseNotes.txt, and the *.se file.

3. Create a <work_directory> in the Linux* machine: mkdir sbl-test

4. Copy the *.se file into your <work_directory>.

5. Make the *.se file executable by running the following command: chmod +x <filename>.se

6. Extract the *.se file by running the following command: ./<filename>.se

7. Page through the license using the space bar. At the end, enter ‘y’ and press ENTER to accept the license.

8. Extract the contents of the *.se file into a directory with the same name as the *.se file (without the .se extension).

9. Extract the SblPlatform.zip file.

10. The following table lists the contents in the extracted *.se file:

    File List

    DOCUMENTATION	Description
    SblPlatform.zip	SBL source code
    UefiPldPlatform.zip (not required if using SBL)	UEFI payload source code
    CfgData	SBL configuration data
    Documents/TGL_UP3_IoT_Features.pdf	Documentation on how to enable Intel® TCC, TSN, IBECC, FuSa
    Documents/TGL_UP3_FirmwareUpdate.pdf	Documentation on how to update firmware
    Documents/SBL_TGL_Security_addendum.pdf	Tiger Lake UP3 Processors security feature
    Documentation/license.txt	License
    Licenses/License Notices.pdf	License notices
    Licenses/Slim Bootloader_C2A_Commercial Use License -limited use binary Final Clean 3.7.19.pdf	Commercial Use License

Enable Intel® TCC in SBL

1. To enable the Intel® TCC subregion setting in SBL, go to the following directory:

   <work_directory>/SblPlatform/SblOpen/Platform/<PlatformBoardPkg>/

   For example, for Intel® Xeon® W-11000E Series Processors (codename: Tiger Lake H Processors) or 11th Generation Intel® Core™ Processors (codename: Tiger Lake UP3 Processors), go to the following directory:

   <work_directory>/sbl-tgl-up3-mr5-rel/SblPlatform/SblOpen/Platform/<PlatformBoardPkg>/

   NOTE:

   Replace <PlatformBoardPkg> with:

   • “TigerlakehBoardPkg” for Intel® Xeon® W-11000E Series Processors

   • “AlderlakeBoardPkg” for 12th Generation Intel® Core™ Processors

   • “TigerlakeBoardPkg” for 11th Generation Intel® Core™ Processors

   • “ElkhartlakeBoardPkg” for Intel Atom® x6000E Series Processors

2. Open the “BoardConfig.py” configuration file and change “self.ENABLE_TCC=1” and “self.ENABLE_TSN = 1”.

3. Save the configuration file.

Download the Cache Reservation Library (CRL) Binary:

The Cache Reservation Library (CRL) binary, formerly known as the Platform Tuning Configuration Manager (PTCM) binary, is a module that implements the logic to create software SRAM buffers within the cache hierarchy on Intel® Xeon® W-11000E Series Processors, 12th Generation Intel® Core™ Processors, 11th Generation Intel® Core™ Processors and Intel Atom® x6000E Series Processors.

The Intel’s Integrated Firmware Image (IFWI) binary enables CRL by default, to create software SRAM regions within the physical address space accessible through Intel® TCC Tools. To enable Intel® TCC Tools, integrate the specific CRL version for your Intel® platform, into the UEFI BIOS or Slim Bootloader.

1. Go to the following directory:

   <work_directory>/SblPlatform/SblOpen/Platform/<PlatformBoardPkg>/

   NOTE:

   Replace <PlatformBoardPkg> with:

   • “TigerlakehBoardPkg” for Intel® Xeon® W-11000E Series Processors

   • “AlderlakeBoardPkg” for 12th Generation Intel® Core™ Processors

   • “TigerlakeBoardPkg” for 11th Generation Intel® Core™ Processors

   • “ElkhartlakeBoardPkg” for Intel Atom® x6000E Series Processors

2. Create the “Binaries” folder in the path.

3. At the following table, find your Intel® platform, look for the latest release, then click the CRL version link to download the .zip file. Then, extract the .zip file.

   CRL and Firmware Compatibility

   Intel® Platform	Release	Intel Firmware Image (IFWI) Kit Version	CRL Version	Intel® TCC Tools Version
   Intel Atom® x6000E Series Processors	MR5	v4326_00	v5.11	2022.2
   Intel Atom® x6000E Series Processors	MR3	v4122_00	v5.11	2022.1
   Intel Atom® x6000E Series Processors	MR2	v3471.01	v5.11	2021.3, 2022.1
   11th Generation Intel® Core™ Processors	MR7	v5455_01	v5.11	2022.2
   11th Generation Intel® Core™ Processors	MR5	v5035_01	v5.07	2022.1
   11th Generation Intel® Core™ Processors	MR4	v4415_01	v5.07	2021.3, 2022.1
   Intel® Xeon® W-11000E Series Processors	MR5	v5285_01	v5.11	2022.2
   Intel® Xeon® W-11000E Series Processors	MR3	v5055_01	v5.07	2022.1
   Intel® Xeon® W-11000E Series Processors	MR2	v4425_01	v5.07	2021.3, 2022.1
   12th Generation Intel® Core™ Processors	MR3	v3381_00	v5.52	2022.2
   12th Generation Intel® Core™ Processors	MR1	v3125_00	v5.52	2022.1
   12th Generation Intel® Core™ Processors	PV	v2501_00	v5.50	2022.1

4. Copy the CRL binary (crl.bin) into the “Binaries” folder.

Set up the Build Environment

NOTE:

The Linux* host system (Ubuntu 20.04 LTS 64-bit) is also supported for code development and compilation, but with limited validation coverage.

Instructions in this section show how to install the following software, to set up the build environment on the Linux* host system:

• GCC 7.3 or above

• Python* release 3.6 or above

• NASM 2.12.02 or above

• iASL 20200326

• OpenSSL* toolkit version 1.1.1 or above

• Git* version control system

1. Install the required packages on the Ubuntu* OS using the following command: $ sudo apt-get install -y build-essential iasl python uuid-dev nasm openssl gcc-multilib qemu git

2. To check if iASL version 2020 or above version is installed successfully: #. iasl -v

3. To install iASLASL version 2020 or above, run the following commands in any folder:

   1. wget https://acpica.org/sites/acpica/files/acpica-unix-20200326.tar.gz

   2. tar xzf acpica-unix-20200326.tar.gz

   3. cd acpica-unix-20200326

   4. make

   5. sudo make install

   See iASL user guide for more details on iASL.

4. Get the OpenSSL toolkit path using the following command:

   whereis -b openssl

5. Export the OpenSSL toolkit path using the following command:

   export OPENSSL_PATH=<OpenSSL_Toolkit_Path>

   E.g. export OPENSSL_PATH=/usr/local/bin/openssl

Generate Keys

Before building the Slim Bootloader, you need to generate a set of cryptographic keys. These keys have the .pem extension, and may be referred to as the PEM keys in other documents. Several Keys are required for SBL components signing and verification. The keys are required as the user will need to put them in a location with a specified name.

1. Go to the SblPlatform directory using the following command:

   cd <work_directory>/SblPlatform

2. Create the SblKeys folder using the following command:

   mkdir SblKeys

3. SBL also provides a tool (SblOpen/BootloaderCorePkg/Tools/GenerateKeys.py) to generate all the keys in the SBL source code. Generate the keys in the SblKeys folder using the following command:

   python3 SblOpen/BootloaderCorePkg/Tools/GenerateKeys.py -k SblKeys

   When using the SBL OsLoader payload, use the following to verify the OS image:

   • OS1_TestKey_Pub_RSA2048.pem or

   • OS1_TestKey_Pub_RSA3072.pem

   Replace them with the respective public keys used when signing the OS Image.

   For OS images with the Yocto Project* container images, refer to the Yocto Project* Best-Known Configuration (BKC) Release Notes. Get the private key used in signing the Yocto Project SBL container image during the Yocto Project image build. Refer to Step 2: Build Yocto Project*-Based Image. Then, extract the public keys and replace them with the following:

   • OS1_TestKey_Pub_RSA2048.pem or

   • OS1_TestKey_Pub_RSA3072.pem

   NOTE:

   The key generation process is a one-time process. Use the same set of keys for signing and verification operations when generating the firmware capsule update image, configuration data, container image, and others. Verification operations will fail (security violations) if different keys are used. Also use the same keys in the sbl_os and sbl_rtcm for the Yocto Project* build image, and for the data streams optimizer tool and the Cache Configurator tool.

   For more information, refer to the key generation procedure in the Keys Generation section of the Slim Bootloader Project Documentation.

Configure the SBL (Optional)

1. Refer to the Slim Bootloader Configuration for more information on configuring the board or platform specific settings (for example, GPIO, features, memory, and boot options) using the SBL configuration data feature.

Build the SBL

1. Change the permissions file on the wrappers with these commands:

   cd SblPlatform/SblOpen/BaseTools/BinWrappers/PosixLike/

   chmod +x *

2. Go to your platform board package directory to open the .dlt file (the file depends on whether you are using LPDDR4 or DDR4), example given as follows:

   vi SblPlatform/SblOpen/Platform/<platform_board_package>/CfgData/CfgData_Int_Tglu_Ddr4.dlt

3. Comment out the payload setting as follows to use the OsLoader payload:

   #GEN_CFG_DATA.PayloadId | 'AUTO'

4. Build the SBL with OsLoader Payload:

   python3 SblPlatform/SblOpen/BuildLoader.py build tgl -r

   NOTE:

   1. -r is for release build. Default is the debug build.

   2. If you get an error, clean using the following command: python3 BuildLoader.py clean.

   3. After the SBL is generated, you can see “Done [platform_codename]!”. The output is located in the Outputs/<platform_codename> folder.

   The SBL supports two different payloads: - OsLoader which is the built-in payload built when building the SBL. - UEFI Payload which needs to be built separately. To build a UEFI payload into the Slim Bootloader, you need to copy UEFIPAYLOAD.FD to SblOpen/Platform/<PlatformBoardPkg>/Binaries/UefiPld.fd before building the SBL.

   NOTE:

   Replace <PlatformBoardPkg> with:

   • “TigerlakehBoardPkg” for Intel® Xeon® W-11000E Series Processors

   • “AlderlakeBoardPkg” for 12th Generation Intel® Core™ Processors

   • “TigerlakeBoardPkg” for 11th Generation Intel® Core™ Processors

   • “ElkhartlakeBoardPkg” for Intel Atom® x6000E Series Processors

   The SBL can be built with the OsLoader and UEFI payload in a single SBL image. If both are built in, you can use J9J5 header on the 11th Generation Intel® Core™ Processors RVP, for example, to select the payload to boot with. - When pin 3-4 are connected, select the UEFI payload. - Otherwise, select the OsLoader payload to boot.

   If you always want to boot to the UEFI payload without using the GPIO pin selection, you can update the config file to specify which payload to boot as follows before the build. As an example, for the 11th Generation Intel® Core™ Processors:

   In SblOpen/Platform/TigerlakeBoardPkg/CfgData/CfgData_Int_Tglu_Ddr*.dlt,

   change: GEN_CFG_DATA.PayloadId | 'AUTO' to GEN_CFG_DATA.PayloadId | 'UEFI'

   To build the SBL with OsLoader and UEFI payload (if you are using the UEFI binaries):

   python3 SblBuild.py build tgl -p "OsLoader.efi:LLDR:Lz4;UefiPld.fd:UEFI:Lzma"

   The Slimbootloader.bin image will be generated in the Outputs/<platform_name> folder.

   NOTE:

   This binary needs to be stitched before writing to flash.

Stitch the SBL

1. Go to your work directory using the following command:

   cd <work_directory>

2. Create the Components folder at your work directory using the following command:

   mkdir Components

3. Go to the Components folder using the following command:

   cd Components

4. Download each “Package” in the table and store all packages in the Components folder.

5. Extract the packages using unzip <filename_and_extension>, for example:

   unzip 'IntelCSME_TGL-U_15.0.35.1951 V6.1_Consumer.zip'

6. Go back to your work directory using the following command:

   cd ..

7. Create the Stitching folder at your work directory using the following command:

   mkdir Stitching

8. Go to the Stitching folder:

   cd Stitching

9. Create each folder listed in the “Destination File” column using mkdir <destination_folder>, for example:

   mkdir Fit

10. Copy all files listed under the “Source File” column to the “Destination File” locations, using cp -r <source_file_path> <destination_file_path>. If you see *.*, you will need to copy all files. For example,

    cp -r ~/<work_directory>/Components/IntelCSME_TGL-U_15.0.35.1951\ V6.1_Consumer/Tools/System_Tools/FIT/Linux64/* Fit/

11. If a different name is given as the “Destination File”, rename the file according to the name given in “Destination File” (e.g. rename “ME_FW_Consumer_15.0.35.1951_prod.bin” to “MeRegionFile.bin”):

    NOTE:

    Contact an Intel representative for the latest Best Known Configuration (BKC) information to obtain the needed stitching components if any of the following links are not available.

Downloading Ingredients

To generate the IFWI for booting, the Slim Bootloader needs to stitch with other ingredients. To facilitate the Slim Bootloader stitching process, some stitch scripts are provided with this release kit to create an IFWI.

Download the latest stitching ingredients by referring to the SBL Firmware Release Notes for your platform:

SBL Firmware Release Notes

Supported Hardware	SBL Firmware Release Notes Document Number
Intel® Xeon® W-11000E Series Processors (Code Name: Tiger Lake H Processors)	634385
12th Generation Intel® Core™ Processors (Code Name: Alder Lake Processors)	751890
11th Generation Intel® Core™ Processors (Code Name: Tiger Lake UP3 Processors)	614394
Intel Atom® x6000E Series Processors (Code Name: Elkhart Lake Processors)	616714

Generate the BpmGen2 Params

Follow these steps to generate the bpmgen2.params file manually using the BpmGen2GUI tool:

NOTE:

Skip the following steps if the bpmgen2.params file has been generated.

1. In Windows* OS, run the BpmGen2GUI tool.

   NOTE:

   1. Anti-malware software may prevent this tool from running. For example, if the Microsoft Defender SmartScreen* software blocks the BpmGen2UI tool, click “More Info” to run the tool.

   2. bpmgen2.params is a default file. As part of the stitching process, the required parameters would be overwritten with get_bpmgen2_params_change_list defined in StitchIfwiConfig*py. This is as per the SBL configuration.

2. Select a working directory (BpmGen2/).

3. Click [Create Boot Policy Manifest (BPM) Def].

   NOTE:

   Do not click the highlighted option, [Create Key Manifest (KM)].

4. Navigate to the BPM Screen 3, as shown in the following figure:

   

5. Click [Save BPM Definition File].

6. Save as bpmgen2.params without changing any default configuration.

7. Copy bpmgen2.params to the BpmGen2 folder in the Linux* OS.

Stitching Steps

Ensure all the stitch components are ready in the <work_directory>/Stitching folder, and the SBL binary in the Outputs/<platform_name> folder. If you need to build the SBL, refer to the Build the SBL section.

Run the following command in the command line console to see the help message about the stitch script: python3 SblOpen/Platform/<PlatformBoardPkg>/Script/StitchIfwi.py -h

usage: StitchIfwi.py [-h] [-p PLATFORM] [-w WORK_DIR] -c CONFIG_FILE [-s SBL_FILE] [-b {legacy,vm,fve,fvme}] [-d PLAT_DATA] [-r] [-t {ptt,dtpm,none}] [-o OPTION] [-op OUTPATH]

For -o parameter, type -o to obtain the following details:

• ‘sata’ – Enable SATA direct port, by default disabled.

• ‘tsn7’ – Enable TSN Port 7, by default TSN port is disabled.

• ‘lp4’ – Stitch for DDRLP4 board, by default for DDR4 board.

• ‘32MB’ – Stitch image set to 32MB, by default use 16MB.

• ‘spi’ – Set SPI frequency to be 25MHz, 33MHz, 50MHz, 100MHz.

As an example, the following steps show how to stitch an IFWI image with the verified boot and measured boot enabled for the 11th Generation Intel® Core™ Processors platform, Bx silicon:

1. Run the following command:

   python3 SblOpen/Platform/TigerlakeBoardPkg/Script/StitchIfwi.py -b legacy -s SblOpen/Outputs/tgl/Stitch_Components.zip -c SblOpen/Platform/TigerlakeBoardPkg/Script/StitchIfwiConfig_tglu.py -w <work_directory>/Stitching/ -p tglu_b0

2. If stitching is successful, the following message is displayed. sbl_ifwi_tglu_b0.bin file is generated in the current folder:

   IFWI Stitching completed successfully! Boot Guard Profile: LEGACYIFWI image: sbl_ifwi_tglu_b0.bin

   NOTE:

   1. The stitch command only helps you to generate an IFWI quickly with the default settings. You can also change soft straps as needed by using the Intel® Flash Image Tool (Intel® FIT) tool based on the generated IFWI image. Refer to TGL-LP Consumer Bring Up Guide.pdf in the Intel® CSME package described in the Downloading Ingredients section.

   2. If you received a “permission denied” error while trying to build the SBL, use the following command to edit the permission so that everyone can access the folder: chmod +x <folder_name/binary_name>

Flash the SBL onto the board.

NOTE:

This activity is applicable on Intel’s Reference Validation Platform (RVP) or Customer Reference Board (CRB). If you are using the Original Equipment Manufacturer (OEM) or Original Device Manufacturer (ODM) board, work with your BIOS vendor or contact an Intel representative.

1. For more information on flashing the bootloader using a DediProg device, refer to the Intel Atom® x6000E Series, and Intel® Pentium® and Celeron® N and J Series Processors for IoT Applications (Elkhart Lake) - CRB User Guide.